Click · a URL shortener with preview
Short links that
show where they go.
Paste a long address and get a short one on labs.llc. Whoever opens it sees the full destination and its host first, and decides whether to continue. There is no automatic redirect, and no tracking beyond one counter per link. Making a short link here is free.
seven-character codes · the destination is never fetched · 10 links an hour and 40 a day from one address · 200 a day across the site · a blocked link answers 410
Shorten
A long address in, a short link out.
The link is labs.llc/click/ and a seven-character code. It opens a preview of the address, never the address itself. The same address asked for twice gets the same link.
Shorten a link
Check a Click link
The preview
What the person who opens the link sees.
- The whole address, written out to the last character, with nothing trimmed.
- The host in bold — the name of the site the link leads to, in the ASCII form the browser will ask for. A host written in non-Latin letters is shown in its punycode form in bold and in the headline, and in Unicode only beside it, with a warning that letters from different alphabets can look alike.
- When the link was made, to the minute, in UTC.
- A Continue button. It is pressed by the reader. There is no timer, no countdown and no script that moves the page.
A Click link never forwards anyone. Opening labs.llc/click/ followed by a code shows that page, on labs.llc. Adding a plus sign to the end of any Click link shows it too. The only way from a Click link to its destination is a person reading the address and pressing Continue.
Click began on its own domain, click.com.im. Since labs 546 every address there answers one permanent redirect to the same page here, so a link made there opens the same preview on labs.llc.
Why a preview
A safe link shortener starts by not redirecting.
An ordinary shortener answers with a redirect: the browser is sent on before the reader has seen where to. The name in the link is the shortener’s, so the reader has nothing to judge the destination by. That is the property a phishing message needs, and it is why Click does not redirect at all.
With a short link preview the name the reader judges is the one printed in bold, and it is the real one. Click does not rate that name or call it safe. It shows it.
What Click refuses to shorten
- Anything that is not http or httpsjavascript:, data:, file:, ftp: and every other scheme.
- A user name or password before the hostThe form user@host is how a link is dressed as another site.
- IP addressesIn every spelling a browser accepts: dotted, decimal, hexadecimal, octal, and IPv6 in brackets.
- Local and reserved nameslocalhost, a host that is a single word, and names under 13 suffixes such as .local and .internal.
- Click itself and other shortenerslabs.llc/click/, click.com.im, labs.llc’s own redirecting short links (labs.llc/<code>, labs.llc/labluxa/<code>), and 13 shortener hosts by name: a short link to a short link hides the destination.
- Addresses that do not read as writtenLonger than 2,048 characters, or holding a space, a backslash, a control character or an invisible one.
Each rule is applied when a link is made and again every time its preview is shown. The full list, with the hosts named, is in the terms: what may not be shortened.
Shorten a URL with no tracking of who opens it
For each link Click stores the code, the destination, the time it was made and one number: how many times its preview page has been shown. Nothing is stored about the people who open a link — no address, no browser, no referrer, no time of visit.
To hold each maker to 10 new links an hour and 40 a day, the server counts against a salted hash of the maker’s IP address, never the address itself. The salt is random, made on the server, and replaced each day at 00:00 UTC. The privacy page says exactly what is stored and for how long.
Limits
Click’s server never opens a destination. It does not scan, scrape or screenshot it, so it cannot tell you whether a site is safe — only which site it is. A public name that points at a private address cannot be detected without looking the name up, and the server looks nothing up.
A link cannot be edited after it is made, and there are no accounts. A link that breaks the terms is blocked and answers “410 Gone”; reporting a short link takes one email. The store holds up to 50,000 links. The method and sources are written out in full.
Method
What is refused, what is kept, what is fetched.
Nothing is fetched
Click has no upstream: no feed, no API, no third party. The page sends one request, to click/api/shorten.php on this site, and only when Shorten is pressed; the server checks the address, writes one line and answers. It never opens, resolves or scans the destination, so a link cannot make labs.llc reach anything.
What is refused, and when
Every rule runs twice: when a link is made, and again every time its preview is shown, because a line in a file is not proof that it once passed. The rules are listed on the terms page: schemes other than http and https, credentials, IP addresses in every spelling, 13 local suffixes, 4 names that point at private addresses, Click itself, labs.llc’s own redirecting short links, 13 other shorteners, and anything longer than 2,048 characters or holding a character that does not read as written.
The limits
10 new links an hour and 40 a day from one address, counted in UTC; 200 requests to make a link a day across the whole site, however many addresses ask; 50,000 links in the store. Past a limit the answer is 429 and says when the count starts again. The people who run Click can pause making links at any time; every link already made keeps opening its preview.
What happens to what you type
The address you shorten is sent to this site’s server when you press Shorten, and not before; it is stored with its code and the time, and shown to whoever opens the link. The address you paste into the check box never leaves your browser: it only opens that link’s preview. Your IP address is never written down — the rate limit keeps an HMAC of it under a salt that is replaced every day. Click’s own script keeps nothing in your browser. Every file, and how long it is kept.
Blocked links and reports
A reported link that breaks the terms is added to a blocklist the people who run Click edit by hand; from the next request it answers 410 Gone and its destination is no longer shown. Reporting takes one email to labs@labs.llc.
Sources
The rules rest on the WHATWG URL Standard (how a browser reads a host that ends in a number), RFC 6761 and RFC 6762 (special-use and link-local names), RFC 3492 (punycode), the HTML Standard’s link types (nofollow, noopener, noreferrer) and the PHP manual’s random_int, all read on 28 September 2026. The method page links each one and says what it is used for.